How to meet it
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Request & Response Logging
Log what retrieval returned
Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.
OWASP AISVS v1.01, requirement 12.1.4
In plain English
Log each retrieval: the query, which documents came back and from which source.
What good looks like
- Retrieval events are logged with query, document IDs and source.
- They link to the model call that used them.
- Logs follow the same retention and access rules as other AI logs.
How teams usually do it
- Logging in the retrieval service, using the shared schema from 12.1.3.
Evidence an auditor would accept
- Sample entries.
Common mistakes
- Logging the answer but not what it was based on.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.